CVE Feed

    Dashboard / CVE / CVE-2026-34759

    CVE-2026-34759

    OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete all existing alerting numbers. This issue has been patched in version 10.0.42.

    Published:Apr 2, 2026
    Last Modified:Apr 14, 2026
    EPS:Apr 2, 2026
    EPSS Score:0.00254
    CVSS Score:8.1

    Affected Products

    Vendor
    Hackerbay
    Product
    Oneuptime
    Vendor
    Oneuptime
    Product
    Oneuptime

    Exploits

    https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6wc5-rhvj-cx7f

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-80350 (CVSS 7.1) — OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of …
    CVE-2026-35053 (CVSS 9.2) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker servic…
    CVE-2026-34840 (CVSS 8.1) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML …
    CVE-2026-34758 (CVSS 9.1) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated a…
    CVE-2026-33396 (CVSS 9.9) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged …
    CVE-2026-33142 (CVSS 8.1) — OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE…
    CVE-2026-33143 (CVSS 8.7) — OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp PO…
    CVE-2026-32598 (CVSS 6.9) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow…
    CVE-2026-32308 (CVSS 7.6) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer com…
    CVE-2026-32306 (CVSS 9.9) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregati…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High